PT-2021-23230 · Symfony+2 · Symfony+2

Jderusse · Published 2021-11-24 · Updated 2024-03-06 · CVE-2021-41270

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Symfony versions 4.1.0 through 4.4.34 Symfony versions 5.0.0 through 5.3.11

Description CSV Injection, also known as Formula Injection, occurs when websites embed untrusted input inside CSV files. When a spreadsheet program opens a CSV, any cell starting with = is interpreted by the software as a formula and could be abused by an attacker. In Symfony, the csv escape formulas option in CsvEncoder was added to prefix all cells starting with =, +, - or @ by a tab t. However, OWASP added two more characters to this list: Tab (0x09) and Carriage return (0x0D), making the previous prefix character part of the vulnerable characters. OWASP suggests using the single quote ' for prefixing the value.

Recommendations For Symfony versions 4.1.0 through 4.4.34, update to version 4.4.35 or later. For Symfony versions 5.0.0 through 5.3.11, update to version 5.3.12 or later. As a temporary workaround, consider using the single quote ' to prefix formulas and add the prefix to cells starting by t, r as well as =, +, - and @.

Exploit

Fix

RCE

Weakness Enumeration

CWE-1236

Related Identifiers

BIT-SYMFONY-2021-41270

CVE-2021-41270

GHSA-2XHG-W2G5-W95X

USN-5290-1

Affected Products

Linuxmint

Symfony

Ubuntu

References · 26

• 🔥 https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/serializer/CVE-2021-41270.yaml · Exploit
• 🔥 https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/symfony/CVE-2021-41270.yaml · Exploit
• https://github.com/symfony/symfony/commit/3da6f2d45e7536ccb2a26f52fbaf340917e208a8 · Patch
• https://github.com/symfony/symfony/pull/44243 · Patch
• https://github.com/symfony/symfony/security/advisories/GHSA-2xhg-w2g5-w95x · Patch
• https://osv.dev/vulnerability/UBUNTU-CVE-2021-41270 · Vendor Advisory
• https://osv.dev/vulnerability/USN-5290-1 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-41270 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-symfony-2021-41270 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QSREFD2TJT5LWKM6S4MD3W26NQQ5WJUP · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2021-41270 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2021-41270 · Security Note
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3BPT4SF6SIXFMZARDWED5T32J7JEH3EP · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/3BPT4SF6SIXFMZARDWED5T32J7JEH3EP · Vendor Advisory
• https://ubuntu.com/security/CVE-2021-21424 · Vendor Advisory